SOVA Android banking trojan add new ransomware feature

The SOVA Android banking trojan has added a new ransomware feature that encrypts files on mobile devices.

The new version 5 of the malware comes with a ransomware module that uses AES encryption to lock all files in infected devices and attach the “.enc” to the renamed, encrypted files.

While it is not yet widely used, Cleafy researchers said the new version of the malware is ready for mass deployment.

SOVA’s new capabilities were uncovered by threat analysts at mobile security firm Cleafy.

According to the researchers, SOVA released version 3 in March 2022. For version 3, the malware added 2FA interception, cookie theft and new injections for several banks worldwide.

SOVA developed version 4, which was released in July 2022.

These features allow the malware to target over 200 banking applications, cryptocurrency exchanges and digital wallets to steal sensitive user data and cookies from them.

Version 4 also provided support for commands such as screenshots, clicks and swipes, copying and pasting files, and arbitrary use of overlay screens. Code refactoring in the cookie stealer mechanism has also been extended to version 4. This mechanism targets Gmail, GPay, and Google Password Manager.

To protect it against server defences, SOVA added some defences, including the abuse of accessibility permissions to push the user back to the home screen when trying to manually uninstall the app.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web